Enable IPv6 on Azure CDN (Microsoft CDN)

nikize 6

We have (Service type) Microsoft CDN (on azureedge.net)
And would like to have that content available over IPv6?

How can we enable this on the CDN profile or CDN Endpoints?

Have read https://learn.microsoft.com/en-us/azure/load-balancer/ipv6-add-to-existing-vnet-cli but do not see how that can be applied to CDN

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-11-26T10:30:00.943+00:00

Hello @nikize ,

I'm discussing this requirement with the Azure CDN product team for more information and will get back to you with an update soon.

In the mean time, may I know which Azure CDN product you are using? Is it Azure CDN from Microsoft/Akamai/Standard Verizon/Premium Verizon?

Regards,
Gita
nikize 6 Reputation points

2021-11-26T12:52:47.75+00:00

Service type is Microsoft CDN

2 answers

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-11-29T13:17:53.67+00:00

Hello @nikize ,

I checked with Azure CDN Product Group team and they stated the below:

IPv6 is enabled by default on Azure CDN depending on the client requests. If it receives IPv6 requests, IPv6 stack will be used.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
nikize 6 Reputation points

2021-11-29T13:49:16.963+00:00

Thanks,

I did not see any AAAA DNS records last I tested. but it is great that it shows up now.
But are you saying that there needs to be an AAAA request before AAAA records are created?

After a few levels of CNAMEs we have star-azureedge-prod.trafficmanager.net.

NS here is
tm2.edgedns-tm.info.
tm1.dns-tm.com.
tm2.dns-tm.com.
tm1.edgedns-tm.info.

None of them has AAAA records

Also neither ns1.t-msedge.net. or ns2.t-msedge.net. has AAAA records

So this still requires DNS with IPv4 to work - could you resolve this as well, thanks.

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-11-30T14:09:10.683+00:00

Hello @nikize ,

In order to see what exactly is happening in your environment, we may need access to the backend of your subscription and will need further investigation. So, if you have a support plan, I request you file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Regards,
Gita
Sign in to comment
nikize 6 Reputation points

2021-12-01T00:40:13.49+00:00
Not able to post this as reply...

I have tested a few hosts, and as I said the host now has AAAA record
However some of the DNS servers required to look that up does not.

These servers are common for everyone using the CDN, as such I do not see this to be specific to backend.
New test is with gentoo.ipxe.se

;; QUESTION SECTION: ;gentoo.ipxe.se. IN AAAA ;; ANSWER SECTION: gentoo.ipxe.se. 3596 IN CNAME gentoo-ipxe.azureedge.net. gentoo-ipxe.azureedge.net. 1796 IN CNAME gentoo-ipxe.afd.azureedge.net. gentoo-ipxe.afd.azureedge.net. 26 IN CNAME star-azureedge-prod.trafficmanager.net. star-azureedge-prod.trafficmanager.net. 26 IN CNAME dual.part-0025.t-0009.t-msedge.net. dual.part-0025.t-0009.t-msedge.net. 102 IN CNAME part-0025.t-0009.t-msedge.net. part-0025.t-0009.t-msedge.net. 119 IN AAAA 2620:1ec:bdf::53 part-0025.t-0009.t-msedge.net. 119 IN AAAA 2620:1ec:46::53

NS for azureedge.net has proper AAAA records, so no problem so far, verify with: (I will leave out the response. *due to limited message size")

> nslookup -type=NS azureedge.net

NS for trafficmanager.net does NOT have AAAA record

> nslookup -type=NS trafficmanager.net

just to be sure, try these (which have no answer):

> nslookup -type=AAAA tm1.dns-tm.com > nslookup -type=AAAA tm2.dns-tm.com > nslookup -type=AAAA tm1.edgedns-tm.info > nslookup -type=AAAA tm2.edgedns-tm.info

Same for NS t-msedge.net no AAAA

> nslookup -type=NS t-msedge.net

The same DNSs as mentioned previously that are lacking IPv6
Please sign in to rate this answer.
GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-12-02T15:32:03.907+00:00

Hello @nikize ,

Azure Traffic Manager does not currently provide IPv6-addressable name servers. However, Traffic Manager can still be used by IPv6 clients connecting to IPv6 endpoints. A client does not make DNS requests directly to Traffic Manager. Instead, the client uses a recursive DNS service. An IPv6-only client sends requests to the recursive DNS service via IPv6. Then the recursive service should be able to contact the Traffic Manager name servers using IPv4.

Did you try sending any IPv6 requests on your Azure CDN?

Regards,
Gita

nikize 6 Reputation points

2021-12-02T15:46:18.537+00:00

I did not need an explanation of how DNS works, I thought I made it quite clear exactly what works and not, every step of the way!

You are correct in that clients usually do not connect to all DNS servers, however recursive DNS services does!
Since I run a IPv6 only recursive DNS the services are unavailable for those clients.

I don't care about trafficmanager, It is your CDN that uses a 4+1 CNAME setup.

In this case, either fix the CDN to not use trafficmanager or other IPv4 only parts, or fix those parts to support IPv6

Please fix ALL and everyone of your services that are not available over IPv6.

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-12-03T04:43:02.177+00:00

Hello @nikize ,

I was not aware that you are running a IPv6 only recursive DNS.
Let me discuss this scenario with the Azure CDN product group team and get back to you.

Regards,
Gita

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-12-15T11:37:40.337+00:00

Hello @nikize ,

Apologies for the delay in my response.

The product team needs to look into your Front Door resource and domain details and also would like to know what kind of connectivity issue you are facing. Is it client to AFD or AFD to origin/backend. So, I would request you to send us an email as requested in the private message for further investigation and resolution of the issue.

Regards,
Gita

nikize 6 Reputation points

2021-12-16T15:57:15.57+00:00

Hi,

You can see the CDN name above and the full DNS chain which starts with gentoo.ipxe.se
First resource in Azure is gentoo-ipxe.azureedge.net

Client is curl on a host that is IPv6 only and running it's own local recursive DNS service.
I think that covers the information that you requested, I don't have to send that privately.

This issue would manifest itself for anyone that is trying to reach Azure CDN resource and is using a IPv6 only recursive DNS.

As stated before: Either fix the CDN to not use trafficmanager (this is what afd.azureedge.net goes to, and we have not say in the matter)
Otherwise make sure that everything, every step of the way is IPv6 accessible IPv4 only parts is not allowed.

Thanks!

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-12-20T12:26:33.667+00:00

Hello @nikize ,

Below is the update from the Azure CDN Product group team:

This is expected behavior as currently as Azure Traffic Manager (ATM) NS servers are not IPv6. These don’t impact clients and connection over IPv6 but only pushes DNS recursion call over IPv4.
As your client is running IPv6 only DNS recursive resolver, they will not be able to connect ATM for DNS resolution as ATM does not have a IPv6 NS.
ATM is working on IPv6 support, but it’s a major effort and will take time to implement.

I'm checking with the Product group team for an approximate ETA on this and will update you.

In the meantime, you could share your feedback in the below forum requesting this feature. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.
https://feedback.azure.com/d365community/forum/8ae9bf04-8326-ec11-b6e6-000d3a4f0789

Regards,
Gita

nikize 6 Reputation points

2021-12-20T13:13:48.79+00:00

Thank you for the reply. We already know that "These don’t impact clients and connection over IPv6 but only pushes DNS recursion call over IPv4." is incorrect. And it is pure horrible that this is re-iterated over and over.

Here is another, 2 year old post, proving that it is causing issues for clients. https://feedback.azure.com/d365community/idea/79a87563-8726-ec11-b6e6-000d3a4f0789

It is not an answer on how to make it work, but it is an explanation why it doesn't and that we probably shouldn't expect it to work correctly for another 5-10 years.

GitaraniSharma-MSFT 47,686 Reputation points Microsoft Employee

2021-12-22T10:17:31.6+00:00

Hello @nikize ,

Thank you for your feedback.

We understand the urgency & importance of this request and hence have raised an internal product feedback item for the Azure Traffic Manager Product team to get this feature worked on at the earliest or at least provide a definite ETA on this feature release.

Regards,
Gita

Patrick O'Brien 6 Reputation points Microsoft Employee

2022-07-04T12:43:27.26+00:00

I was pointed at this conversation by my colleagues and see that the activity is a few months old. Nevertheless, I will provide some comments to the above. This is a commonly requested feature across Azure as was indicated in the feedback channel link. The reality however is that many services do not and will not support IPv6 natively for the short-term to medium-term. That said, Azure has many government customers who have been able to use the existing services while meeting federal compliance requirements, such as IPv6 for websites.

Rest assured that Azure is aware of this request and we are always prioritizing new features and improvements. There is no ETA or further information to share at this time.

If there are any questions about which Azure services to use to meet a requirement, I encourage any readers to open an Azure support ticket and explain your needs.

nikize 6 Reputation points

2022-07-04T13:00:53.267+00:00

@Patrick O'Brien This comes back over and over in different forms.

Either US gov are running on different configuration, or they are not actually complying even if you/they think they are.

The mandate is IPv6, the goal is to not require IPv4, by using AFD v4 is still required.

See above about DNS, where TrafficManager configuration is broken and REQUIRES working IPv4 to be reachable, this is "only" one DNS server that is v4 only, but that is enough to not be compliant.

Should we dig up all the places where TrafficManager team says that "every recursive DNS server has IPv4"? Also relevant link from above: https://feedback.azure.com/d365community/idea/79a87563-8726-ec11-b6e6-000d3a4f0789

If MS had an interest in resolving this, they could run a recursive DNS service or proxy DNS for the non v6 DNS server and add relevant AAAA records.

Patrick O'Brien 6 Reputation points Microsoft Employee

2022-07-04T14:19:47.51+00:00

This is reasonable feedback and I agree that if a dependency on ipv4 remains then the requirement is not being met. We will review this part and try to provide an update.

nikize 6 Reputation points

2022-07-04T14:28:28.767+00:00

Thanks!
Sign in to comment